Cannot start windows event log service on Windows 7. Error 4201.__

Hi rung_windows7,

Renaming or deleting the following folder seems to work for some users:

C:\Windows\System32\LogFiles\WMI\RtBackup

REF: Event log error 4201 - ERROR_WMI_INSTANCE_NOT_FOUND (a helluva great thread)

---

Ramesh Srinivasan, Microsoft MVP [Windows Desktop Experience]

We have this problem with Windows 10 Professional.  But renaming or deleting RtBackup does not fix the Event Log Service starting error.  We've verified that all WMI Namespaces and entries, and the repository is in perfect health and everything is working.    We've even restored the SOFTWARE and SYSTEM registry 3 weeks back when it was all working by no change...  hmmm puzzling.

Cannot start the Windows Event Log service on Local Computer.  Error 4201: The instance name passed was not recognized as valid by a WMI data provider.

The renaming or deleting or changing the permissions of R tBackup did not fix this error for me,, after many weeks of testing and poking I found my solution , and I hope it helps others who haven't found a fix yet.

• Open the Registry and Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\

• Under this key are 3 EventLog- keys, each one has a DWORD(32) value called LogFileMode, if these aren't set correctly it causes the EventLog to fail to start with the 4201 Error. Here are the correct settings for each key...

\EventLog-Application\LogFileMode - value should be 11000180 (Hex)

\EventLog-Security\LogFileMode - value should be 100001c0 (Hex)

\EventLog-System\LogFileMode - value should be 10000180 (Hex)

Now reboot the PC and see if the eventlog service now starts

Good Luck

Hey,

I was following this guide and none of the actions here worked for me

I was unable to delete RtBackup folder due to 'files in use' under the directory 

(checking with procexp.exe i found these are being held by SYSTEM process

what i did was:

1. open regedit
2. navigate to  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger
3. go over every sub-directory that is directly under Autologger and look for the Start DWORD and set it to 0

by that we disabled auto-start logging at boot time for each of them.

4. restart
5. You should be able to delete 'RtBackup'  now
6. once the folder has been deleted - you may revert the previous changes made to Start DWORD (set it back to 1)

that worked for me

Hope this helps you

Moshe